ta: ta.ld.S: add __exidx_start and __exidx_end

Preparing for C++ support in TAs.

__exidx_start and __exidx_end are referenced by libgcc_eh.a.

Signed-off-by: Jerome Forissier <jerome@forissier.org>

ta: ta.ld.S: add __exidx_start and __exidx_end

Preparing for C++ support in TAs.

__exidx_start and __exidx_end are referenced by libgcc_eh.a.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred.

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred. This makes the calls easier to follow and
corresponds to what the GDB backtrace command (bt) does. For data or
prefetch aborts it is even more important because now we report exactly
the line that caused the abort instead of showing the next one, which
could be misleading.

As a result of this fix, the extra "nop" instruction in __ta_entry() is
not needed anymore so remove it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: export CFG_TEE_TA_LOG_LEVEL with ?= not :=

The value of CFG_TEE_TA_LOG_LEVEL used at optee_os build time is
exported to the TA dev kit ($O/export_ta_arm{32,64}/mk/conf.mk). The
purpose is to pro

ta: export CFG_TEE_TA_LOG_LEVEL with ?= not :=

The value of CFG_TEE_TA_LOG_LEVEL used at optee_os build time is
exported to the TA dev kit ($O/export_ta_arm{32,64}/mk/conf.mk). The
purpose is to provide a default value to the TA build environment,
which can easily be changed from the command line ("make
CFG_TEE_TA_LOG_LEVEL=3" for example).

However the following TA Makefile won't behave as expected:

BINARY := <somme uuid>
CFG_TEE_TA_LOG_LEVEL := 3 # Ignored!
include $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk

This commit changes := to ?= so that ta_dev_kit.mk won't override any
value that may have been set previously in the TA Makefile or the
environment.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: fix race when generating conf.mk

This patch fixes the following error triggered by a heavily parallel build:

echo sm := ta_arm64 > .../export-ta_arm64/mk/conf.mk.tmp
/bin/bash: .../export-

build: fix race when generating conf.mk

This patch fixes the following error triggered by a heavily parallel build:

echo sm := ta_arm64 > .../export-ta_arm64/mk/conf.mk.tmp
/bin/bash: .../export-ta_arm64/mk/conf.mk.tmp: No such file or directory

Fixes: https://github.com/OP-TEE/optee_os/issues/3999
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Ross Burton <ross.burton@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk: core: ta: Configurable Python interpreter

Build systems that manage multiple different python interpreters need
explicit control over which version of the interpreter to use.
This patch enables

mk: core: ta: Configurable Python interpreter

Build systems that manage multiple different python interpreters need
explicit control over which version of the interpreter to use.
This patch enables one to override the default interpreter with the path
to a specific one.

Signed-off-by: Dick Olsson <hi@senzilla.io>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs of the persistent objects
of the token.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a objec

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a object in the PKCS11 ta.
* Helper functions for assigning or checking object attributes
according to PKCS#11 specification.
* Add id-to-string conversion for attribute/class/key types.
* Helper functions to analyze object attributes.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Eti

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: change return types to enum pkcs11_rc]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: R

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@found

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
und

libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
underscore so that the names cannot clash with user-defined symbols.
Doing so is common practice for "system" libraries, as defined by the C
standard in a set of requirements that can be summarized as follows
(excerpt from the GNU libc documentation [1]):

[R]eserved names include all external identifiers (global functions
and variables) that begin with an underscore (‘_’) and all identifiers
regardless of use that begin with either two underscores or an
underscore followed by a capital letter are reserved names. This is so
that the library and header files can define functions, variables, and
macros for internal purposes without risk of conflict with names in
user programs.

The utee_*() wrappers are internal to OP-TEE and are not supposed to be
called directly by TAs so this should not have any user-visible impact.

Link: [1] https://www.gnu.org/software/libc/manual/html_node/Reserved-Names.html
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

TA dev kit: clang: link shared libraries with -z separate-loadable-segments

ldelf crashes with the following assertion when trying to load a shared
library built with Clang 10 (Clang 9 works fine):

TA dev kit: clang: link shared libraries with -z separate-loadable-segments

ldelf crashes with the following assertion when trying to load a shared
library built with Clang 10 (Clang 9 works fine):

E/LD: assertion 'seg->flags & PF_W' failed at ldelf/ta_elf.c:551 in adjust_segments()

The reason is, the virtual addresses of the PT_LOAD segments are always
paged-aligned with Clang 9 while they are not with Clang 10. Luckily,
ld.lld version 10 has introduced a new flag: -z separate-loadable-segments
[1]. Let's use this flag when supported.

Link: [1] https://manpages.debian.org/experimental/lld-10/ld.lld-10.1.en.html#separate-loadable-segments
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. B

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. But for in-tree TAs, this variable is never set
outside the in-tree TA makefiles (ta/*/user_ta.mk). Therefore it is
mandatory for in-tree user TAs to set the variable or various issues
will happen (build error or unexpected version taken from the TA that
happened to have been built just before).

To address the problem and for consistency this commit sets a default
value of 0 for user-ta-version in ta/mk/build-user-ta.mk before
including user_ta.mk.

Fixes: 682f256caaf6 ("TA dev kit: expose CFG_TA_VERSION build option")
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is t

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is too late to be useful (core/arch/arm/arm.mk is
included by core/core.mk before mk/compile.mk).

This commit addresses the issue by moving the definition of cc-option
to its own file, mk/cc-option.mk, which is then included by
core/arch/arm/arm.mk. There is a dependency on the compiler definitions
(mk/gcc.mk or mk/clang.mk) and on $(arch-bit-$(sm)) so
core/arch/arm/arm.mk is modified accordingly.

Moving cc-option out of mk/compile.mk means that all non-core
submodules would lose the definition unless they include
mk/cc-option.mk; the TA dev kit is modified so that TAs can call
cc-option from within their sub.mk files. As for other submodules, they
are internal and do not use cc-options as of now so they are not
modified.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.l

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.lld: error: undefined symbol: __aeabi_mem*

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: simple typo fixes in comments in ta/pkcs11 tree

* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c

Signed-off-by: Markus S. Wamser <github-dev@mail2013

ta: simple typo fixes in comments in ta/pkcs11 tree

* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c

Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: add early TA to seal and unseal Linux trusted keys

This patch adds an early TA which acts as Linux TEE bus device to
provide a service of sealing/unsealing of trusted keys in case platform
doesn

ta: add early TA to seal and unseal Linux trusted keys

This patch adds an early TA which acts as Linux TEE bus device to
provide a service of sealing/unsealing of trusted keys in case platform
doesn't posses a TPM device or like.

To do sealing/unsealing we use system pseudo TA service to derive a
hardware unquie key to perform authenticated encryption/decryption
(using TEE_ALG_AES_GCM algo).

Also, this early TA only accepts login with a new private login method
specifically used by REE kernel (TEE_LOGIN_REE_KERNEL).

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pksc11: update for trace and command exit

Use character flag '#' instead of plain "0x" prefix.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome

ta: pksc11: update for trace and command exit

Use character flag '#' instead of plain "0x" prefix.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: rename PKCS11_UNAVAILABLE_INFORMATION

Rename PKCS11_UNAVAILABLE_INFORMATION to PKCS11_CK_UNAVAILABLE_INFORMATION
as it relates to Cryptoki CK_UNAVAILABLE_INFORMATION identifier.

Reviewe

ta: pkcs11: rename PKCS11_UNAVAILABLE_INFORMATION

Rename PKCS11_UNAVAILABLE_INFORMATION to PKCS11_CK_UNAVAILABLE_INFORMATION
as it relates to Cryptoki CK_UNAVAILABLE_INFORMATION identifier.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: fixup PKCS11_UNDEFINED_ID]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: token_capabilities.h: add missing includes

Adds missing includes in token_capabilities.h.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jer

ta: pkcs11: token_capabilities.h: add missing includes

Adds missing includes in token_capabilities.h.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...